Skip to main content
Auth0 support ends on December 31, 2026. The first Noxus release after that date does not include Auth0. Complete this migration before you upgrade past it.
Noxus is replacing Auth0 with Better Auth as its authentication provider. Every installation that uses Auth0 must complete this migration before it upgrades past the end of Auth0 support. Users keep their accounts, organization, workspaces, roles, ownership, API keys and history. If you are not finished by the end date, stay on the last release that supports Auth0, complete the migration, then upgrade.

​
Who needs to do what

​
SaaS

Noxus migrates SaaS for you. Users keep signing in with the same login method, and their accounts and workspaces stay the same. If your users sign in with email and password, Noxus tells you before the switch how they set up their Better Auth password.

​
Self-hosted installations

A platform administrator runs the migration with the Auth Migration checklist, as described below. Plan for it before the end date. For each login method your users have (Google, Microsoft, OpenID Connect or SAML), you need a compatible application in that provider and its credentials, for example a client ID and client secret. For Microsoft Entra OIDC, reuse the existing app registration so users retain the same identity. These often come from another team, so ask early. See Before you get started.

​
What users should expect

Existing Auth0 logins keep working while you prepare Better Auth. Users do not need to choose an authentication provider at sign-in. Tell password users whether they will keep their password, reset it or receive a setup link, based on the method you choose in the checklist. Before retiring Auth0, ask users to test their Better Auth login. Once you retire Auth0, existing Auth0 sessions end and users must sign in with Better Auth.

​
Before you get started

Review the login compatibility requirements, then prepare these items before you open the checklist. Some come from other teams, so request them early.
  1. Upgrade your installation to a release that includes the Auth Migration checklist. If you run more than one frontend or backend instance, upgrade all of them. Do not change any Auth0 settings: users keep signing in with Auth0 until the migration is complete.
  2. Ask the Noxus team to enable the Auth Migration checklist for your organization. If the section is still hidden, ask your deployment administrator to check whether authentication settings are locked.
  3. Back up the platform database.
  4. Check your administrator account. You need a platform administrator who signs in with Auth0 and whose Auth0 email matches their Noxus email.
  5. Optional: choose your email sender. By default, Noxus sends verification, password reset and setup emails from a Noxus address, so you do not need to set anything up. To send them from your own domain, get a SendGrid API key or SMTP details, and a From address.
  6. Prepare applications only for the login methods your users sign in with today. For example, if your users sign in only with email and password and Google, you need only a Google application. You do not need to set up any other method. Work with your identity provider administrators: When you add each method in the checklist, Noxus shows what to enter back in the provider: the Authorized redirect URI (Google, Microsoft), the Callback URL (OpenID Connect), or the ACS URL and SP entity ID / metadata URL (SAML).

​
Run the migration checklist

Sign in as a platform administrator with your Auth0 login and open Settings → Identity & access → Auth Migration. Each item shows whether it is done. Items that still need action have a button that opens a dialog. If you cannot use a button yet, hover over it to see why.
1

Check user emails in Auth0

Noxus checks that active users have the same email in Noxus and Auth0. Choose Update emails to apply the proposed corrections, and review any users whose emails cannot be updated. You can choose Skip to continue, but users with mismatched emails cannot migrate until those mismatches are resolved.
2

Enable Better Auth

Choose Enable Better Auth. Noxus prepares your administrator account to use Better Auth. If it cannot (for example, your Auth0 email does not match your Noxus email), choose Prepare my account after you fix the problem. Both providers now work.
3

Add login connections

The checklist lists each login method your active users have that has no Better Auth connection, for example Google or SAML. Add each one, as described in Login methods. Give the URLs that the dialog shows to your identity provider administrators. You cannot import users until every supported login method in the checklist has a connection.
4

Set up password users

Choose how email and password users get a Better Auth password:
  • Users reset their password: users choose Forgot your password? at sign-in.
  • Email setup links: you send each user a link to set a new password. The link works once and expires after seven days.
  • Import existing passwords from Auth0: users keep their password. See Import existing passwords.
All three methods need authentication email: resets and setup links are sent by email, and users whose imported password has an unverified email get a verification email. Noxus sends it by default. If email is turned off, the item shows Configure email. To use your own sender, see Authentication email. You can change the method later.
5

Import users

Choose Import users, select the destination connection for each Auth0 source, review the users and confirm. Importing sends no email. Conflicts, inactive users and SAML users outside the connection’s email domain are skipped with a reason. You can repeat an import safely. Each Auth0 OIDC connection has its own destination; select the matching Better Auth connection for each one. If users are marked Ready to repair the provider user ID, import them again before retiring Auth0. This repairs their existing accounts without creating duplicates. If the Auth0 connection list cannot be loaded, resolve the reported issue and refresh before importing OIDC users.
6

Use Better Auth for new accounts

Choose Switch to Better Auth. New accounts now use Better Auth, and existing users can still sign in with Auth0. If you have active password users, you must first choose a password setup method, and email must be on.
7

Prepare a login for every active user

The item shows how many users have signed in with Better Auth. View users lists the users who still need a Better Auth login, and why. Resolve the issues listed for each user. If you chose Email setup links, open Import users, review the password source, select imported users and choose Send setup links. Users can also add a login in Settings → User → Profile → Connected sign-in accounts; if prompted, they must first choose Prepare account for linking. The connected account must use the same email. Ask users to test their Better Auth login before you retire Auth0.
8

Retire Auth0

Sign in with Better Auth (not with your Auth0 login) and choose Retire Auth0. Noxus checks again that every active user has a login. If some users have not tested their Better Auth login yet, the dialog lists them and asks you to confirm. After this, Auth0 logins and sessions stop working. Accounts, connections and permissions are kept.

​
Import existing passwords

To let users keep their Auth0 passwords, choose Import existing passwords from Auth0 in Set up password users, then choose Continue. To import more later, choose Import passwords on that item.
  1. Get the Auth0 password export file from the Noxus team.
  2. Upload the extracted JSON or newline-delimited JSON file (up to 20,000 users and 10 MB).
  3. Review the matched users and confirm. Each import handles up to 100 users: choose Import next 100 passwords until all are imported.
The export must match existing active users in Noxus. Review any skipped users and the reasons shown in the preview. Importing never replaces a password that a user has already set in Better Auth. Users whose email Auth0 verified can sign in with their password right away, without email delivery. Users whose email Auth0 did not verify keep their password, but get a verification email at their first sign-in. The export contains sensitive password data. Delete your local copy according to your credential handling policy after importing.

​
Pause or go back

You can leave the checklist and return later. Until you retire Auth0:
  • Use Auth0 for new accounts returns new signups to Auth0 while existing users can use either provider.
  • Use Auth0 only returns all sign-ins to Auth0 and ends Better Auth sessions. Sign in with Auth0 to use this option. Users who only have a Better Auth account will need an Auth0 login. Imported accounts and connections remain saved.

​
Login compatibility to check before migrating

  • Google and personal Microsoft accounts: users must use the same account as before. The Microsoft connection must allow personal accounts. If an account cannot be imported, have the user connect a supported login method from their profile.
  • GitHub and Auth0 Azure AD connections: these cannot be imported directly. Affected users must connect another supported login method before you retire Auth0.
  • OpenID Connect: ask your identity provider administrator to preserve each user’s subject identifier. For Microsoft Entra OIDC, use the same app registration as the Auth0 connection; a new registration gives users different identifiers.
  • SAML: the new application must send the same NameID as the Auth0 application. Confirm this with your identity provider administrator before importing; some providers assign a different NameID to each application. Users must start sign-in from Noxus. IdP-initiated login, signed authentication requests, encrypted assertions and Single Logout are not supported.
  • MFA: Better Auth does not currently provide MFA for password users. If you require MFA, configure SSO with MFA enforced by your identity provider before retiring Auth0.